📦 度小满支付技能 — 钱包支付码
v1.0.7当SP服务余额不足或未购买时，自动获取商品信息、生成支付二维码并通过飞书推送给用户，实现一键续费。
0· 149·1 当前·1 累计
by @duxiaoman (度小满)
下载技能包
最后更新
2026/4/14
安全扫描
OpenClaw
安全
medium confidenceThe skill does what it says — generate payment QR codes for dxmpay links — but it expects Node.js at runtime and can optionally make an outgoing POST to www.dxmpay.com when short-linking is enabled (a metadata field omission and the optional external call are worth noting).
评估建议
Before installing: (1) be aware the skill runs a Node.js script (Node v18+ recommended) though the registry metadata doesn't list Node as a required binary — ensure host has Node available. (2) The short-link feature (--short-url) will make an outbound HTTPS POST to www.dxmpay.com; only enable it if you trust that domain. (3) The script writes PNGs to the system temporary directory (tmp) and returns a base64 data URL; the SKILL.md explicitly says not to display the base64 field, so calling skill...详细分析 ▾
ℹ 用途与能力
The skill's name/description align with its code and SKILL.md: it generates payment QR codes for provided product data and enforces the dxmpay domain. Minor inconsistency: the registry metadata lists no required binaries, but the SKILL.md and scripts explicitly require Node.js (recommended v18+).
✓ 指令范围
SKILL.md instructs the agent to invoke node scripts/qrcode.js with a structured JSON input. The runtime instructions and the script are scoped to validating the payUrl, generating a PNG QR to the OS tmpdir, and returning a base64 result; they do not instruct reading unrelated files or secrets. The doc also explicitly warns not to display the base64 qr field.
✓ 安装机制
No install spec; this is an instruction-only skill with local JS files included (qrcode.min.js + qrcode.js). No network downloads or archive extraction during install — low install risk.
ℹ 凭证需求
The skill requests no environment variables or credentials. It does, however, make an optional outbound HTTPS POST to https://www.dxmpay.com/facilepaycenter/tinyurl/createurl when run with --short-url; SKILL.md documents this and requires payUrl to be https://www.dxmpay.com/. Users should only enable short-linking if they trust that domain.
✓ 持久化与权限
The skill does not request persistent or elevated privileges, does not set always:true, and does not modify other skills or global agent settings. It writes temporary files only to the system tmpdir.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.72026/4/2
dxm-claw-pay 1.0.7 - 明确要求：“不要展示qr字段对应的二维码base64” - 其余功能、工作流及调用说明保持不变
● 无害
安装命令
点击复制官方npx clawhub@latest install dxm-claw-pay
镜像加速npx clawhub@latest install dxm-claw-pay --registry https://cn.longxiaskill.com